Dive Brief:
- Tennessee’s Memphis-Shelby County Schools is suing ed tech provider PowerSchool, filing a complaint in federal court just a day before the company publicly confirmed that multiple school districts were being extorted over stolen student and teacher information from a December 2024 data breach.
- The lawsuit filed in the U.S. District Court of Southern California accuses PowerSchool of negligence, breach of contract and false advertising related to the far-reaching hacking incident.
- The 110,000-student district, which has paid PowerSchool $21 million over the last 12 years for its services, seeks monetary damages to cover expenses incurred from addressing the concerns of students and staff whose personal information was stolen. Damages are also being sought for any costs associated with recovering from the data breach’s impact.
Dive Insight:
This is not the first time a school district has sued PowerSchool since the company announced the incident five months ago. But Memphis-Shelby County Schools is one of the largest districts to feel the effects, said William Shinoff, an attorney at Frantz Law Group, which is representing over a 100 school districts in cases against PowerSchool.
“These schools are not private businesses,” Shinoff said, adding that when districts contract with PowerSchool “to provide services with public dollars, they expect to receive the services contracted for, and it’s not a small amount of money.”
Ultimately, he said, districts are “really trying to seek reimbursement for taxpayer dollars that they overpaid, because they [PowerSchool] didn’t meet their obligations under the contract.”
Shinoff said he expects to see a surge in the number of district cases against PowerSchool.
Separately, there have been about 50 class action lawsuits filed on behalf of teachers and students impacted by the PowerSchool breach. Those lawsuits — consolidated in April before the U.S. District Court of Southern California — are represented by multiple other law firms and not Frantz Law Group, which Shinoff said is primarily focused on school district contracts.
Preliminary hearings for both the class action lawsuits and the district cases are being held on Wednesday, according to Shinoff.
While PowerSchool declined to comment on ongoing litigation, a spokesperson wrote in an emailed statement to K-12 Dive that the company “is focused on working through this matter directly with our customers. We care deeply about the students, teachers, and families we serve and are wholeheartedly committed to supporting them."
In December, hackers gained unauthorized access to PowerSchool’s Student Information System by infiltrating the company’s PowerSource customer support portal for district and school staff. PowerSchool previously told K-12 Dive that the same system did not use multifactor authentication — a standard and encouraged practice for protecting sensitive data — at the time of the incident.
PowerSchool is the largest cloud-based education software provider in the U.S. and serves more than 75% of students across North America, according to Memphis-Shelby County Schools’ lawsuit.
Additionally, the lawsuit claims that some of the compromised data includes students’ and staff's names, addresses, Social Security numbers, phone numbers, email addresses, medical information, grades, bus stops, passwords and student IDs.
Memphis-Shelby County Schools wrote in its complaint that it is “likely” the personal information of the district’s students and parents has or will soon be “published and sold on the Dark Web.”
PowerSchool’s initial messaging to districts in January — that the data breach was being addressed and shouldn’t be cause for concern — gave “false hope,” Shinoff said.
Even if districts wanted to stop using PowerSchool’s services, it’s “not something they can do overnight,” he said. It could take years to migrate the data from these cloud-based software platforms, and it will cost millions of dollars to do it, Shinoff added.
“That’s the eventual reality,” Shinoff said of the disintegrating relationship between districts and PowerSchool. “There's not much trust.”
